Re: [PATCH v2] mm/damon/vaddr: remove redundant RCU lock

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] VMA iteration on an external mm_struct is performed without checking check_stable_address_space(mm), which can lead to iterating a corrupted maple tree.
--

commit fdc4435ee0611e8373511ef284a90ecc98420eec
Author: Igor Putko <igorpetindev@gmail.com>

mm/damon/vaddr: remove redundant RCU lock

This commit removes rcu_read_lock() and rcu_read_unlock() from
__damon_va_three_regions() and adds them to its kunit test. It asserts that
mmap_read_lock() is sufficient to protect the maple tree during VMA iteration.

> diff --git a/mm/damon/vaddr.c b/mm/damon/vaddr.c
> index e73ec1ce016e5..882cc7cb09027 100644
> --- a/mm/damon/vaddr.c
> +++ b/mm/damon/vaddr.c

[ ... ]

> @@ -82,7 +82,6 @@ static int __damon_va_three_regions(struct mm_struct *mm,
>  	 * If this is too slow, it can be optimised to examine the maple
>  	 * tree gaps.
>  	 */
> -	rcu_read_lock();
>  	for_each_vma(vmi, vma) {

[Severity: High]
This is a pre-existing issue, but while reviewing the VMA traversal here,
I noticed a potential problem with how the mmap_read_lock is used by the
callers of this function.

When traversing VMAs on an external mm_struct, does this code need to check
check_stable_address_space(mm) before iterating? 

Looking at damon_va_three_regions() and damon_va_walk_page_range(), they
acquire mmap_read_lock(mm) and proceed directly to VMA traversal:

mm/damon/vaddr.c:damon_va_three_regions() {
	...
	mmap_read_lock(mm);
	rc = __damon_va_three_regions(mm, regions);
	mmap_read_unlock(mm);
	...
}

If the OOM reaper runs on the target process, it can mark the mm as unstable
and leave XA_ZERO_ENTRY markers in the maple tree. Iterating this corrupted
tree without first verifying check_stable_address_space(mm) can lead to
kernel crashes.

Could this be triggered under system memory pressure while DAMON is
monitoring?

>  		unsigned long gap;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630130253.3843-1-igorpetindev@gmail.com?part=1